Ryan Griggs's questions

I am doing some testing with the NodeJS smtp-server module. It exposes a listening SMTP server on any specified port. SMTP usually runs on port 25, but in order to run the Node app as a non-root user, I am prevented from binding to ports below 1000.

Since I am already using nginx on this machine, I thought the simplest way to get around this would be to bind the server internally to a higher port, for example, 2500. Then use nginx to proxy the SMTP port (25) and directly pass through traffic to the internal listening port.

How can I configure nginx to proxy/passthrough incoming SMTP connections on port 25 to the port on which smtp-server is listening? In this case, incoming TCP connections on port 25 should be directly forwarded to localhost:2500.

Note that the smtp-server app already handles SMTP authentication, TLS, etc, so nginx should not attempt to do those operations. It should just pass the traffic directly through.

I support several organizations which have their users' email hosted on third-party Exchange services (not Office365). The total number of mailboxes is approximately 50.

These Exchange hosts perform regular backups of the users' data, but charge fairly high fees for restorations if, for example, the user deletes their mailbox or other accidental user error. Also, their backups are not as frequent as I would prefer, being several days apart in some cases.

Since I don't have Admin access to these Exchange servers, I can't install or set up local backup software on them. Therefore I need a local way to sync their mailboxes to local file(s).

The obvious way would be to create an Outlook profile for each user on my backup computer, and then log into Outlook for each user daily, allowing them to sync with the local PC, with the Outlook cache age set to "All". This would at least download a local snapshot of their entire Exchange account (email, contacts, calendars, to-do, etc) to the PC into an .OST file, which I could use to restore later if necessary. However, this way would be impractical due to the number of Exchange accounts that I need to back up. Also, it would require manual action on my part.

Does anyone know of a way to accomplish this type of "backup" in an automated fashion? The closest thing I've seen so far is a software called MailStore that can be scheduled to do this. However, it only downloads email messages, and omits all calendar entries, contacts, etc. I need the entire account, not just email.

Maybe Powershell scripts are the answer. Not sure at this point.

Thank you for any pointers!

In the CUPS web interface, when adding a printer, the interface displays all detected printers, both local and networked, and the user can pick which one they want to add to CUPS.

How can I get this list from the command line?

Thank you.

I'm running CUPS 2.2.10 (Raspberry Pi). I have two Zebra label printers connected to USB ports. Each is configured in CUPS. They print fine with no issues unless one printer is turned off. Then if a job is sent to that printer, CUPS freezes and won't send jobs to either printer. lp command simply hangs and won't complete, no matter what. It is necessary to delete the jobs from that printer's queue before any jobs can be sent to any printer.

How to fix this? It seems there should be a timeout that expires on jobs sent to offline printers. Also, why does one printer being offline cause the lp command to freeze on any execution, even without command-line parameters? It also seems printer communication should be asynchronous - even if one printer is offline/frozen and can't print items in its queue, other printers should still work.

Thanks for any advice.

As a sanity test, at the head of my HTML page, I'm trying to do a very simple SSI echo to indicate to the browser that SSI is working:

index.html:

<script>var ssi_enabled = false</script>
<!--# set var="test" value="<script>ssi_enabled=true</script>" -->
<!--# echo var="test" -->

then later in JS:

if (!ssi_enabled) { console.log("SSI is not enabled!"); }

But when nginx echoes the string, the HTML tags are sanitized as follows:

<script>ssi_enabled=true</script>

I can't find anything in the nginx docs that indicates how to echo raw HTML.

Yes I know I could import a html file, but was trying to avoid it as that adds more complexity. Seems like this could be done but I'm just missing the correct parameter for echo.

Thanks

I am currently dealing with a site which has about 40 users, each with his/her own local Outlook setup on their PCs (currently connecting via POP/IMAP to the mail server).

They have asked me to migrate all users to a cloud hosted Exchange service.

I know how to manually export their local data into a PST, then re-import it into each Exchange account, but this will be a hugely time-consuming process. Is there any way to automate this, even to the point where each user can do his/her own migration by simply clicking a few buttons or running a script?

After I manually create the users in the hosted Exchange environment, the steps that need to happen for each user are:

1. Open Outlook and do a full export to PST file of all existing email/contacts/calendars/notes/etc.
2. Close Outlook, go to "Mail" in Control Panel and create new profile.
3. Connect the new profile to the Exchange server using the user's credentials
4. Launch Outlook using the new profile and import the previous PST file, then wait for it to sync with the server.
5. (Optional) I suppose it would be nice if the autocomplete entries were preserved as well.

I'm wondering if PowerShell can reach this level of integration with Outlook.

I would be very grateful for suggestions on how to accomplish this, whether it's a script, an application, batch file, etc. Surely this is a somewhat common issue, so I'd think there would be a fairly simple solution.

I am trying to set up a wildcard certificate using Let's Encrypt on an Ubuntu 18.04 server running apache2, for domain abc.def.com (not the real domain name) and all subdomains (*.abc.def.com)

I have succeeded in generating the certificate manually using the following command:

certbot certonly --manual -d abc.def.com -d *.abc.def.com

I followed the directions, created a TXT record for the abc.def.com domain, etc. and received confirmation that the certificate was successfully created and saved in /etc/letsencrypt/live/

I modified the site's /etc/apache2/sites-enabled/001-abcsite-le-ssl.conf to ensure it referenced the new certificates in /etc/letsencrypt/live as follows:

<IfModule mod_ssl.c>
<VirtualHost *:443>
        ServerName abc.def.com

        ServerAdmin [email protected]
        DocumentRoot /var/www/abc

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

SSLCertificateFile /etc/letsencrypt/live/abc.def.net-0001/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/abc.def.net-0001/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>

I restarted apache2 and confirmed no errors reported.

service apache2 restart

Now, when I attempt to access https://abc.def.com I get a SSL_ERROR_BAD_CERT_DOMAIN error, stating "This certificate is only valid for *.abc.def.com"

I don't understand why, since I included options for both abc.def.com and *.abc.def.com in the certbot request.

I then tried including the non-wildcard certificate I had previously generated, which only applies to abc.def.com, as another set of SSLCertificateFile and SSLCertificateKeyFile directives in the VirtualHost config file, but it doesn't make any difference.

What am I doing wrong?

UPDATE: I was able to force it to work using both certificates by setting up two VirtualHost sections as follows. But there must be something wrong with the wildcard cert if it doesn't cover the root name also, right?

<VirtualHost *:443>
    ServerName abc.def.com
    ServerAdmin [email protected]
    DocumentRoot /var/www/abc
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    SSLCertificateFile /etc/letsencrypt/live/abc.def.net/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/abc.def.net/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>

<VirtualHost *:443>
    ServerName localhost.abc.def.com
    ServerAlias *.abc.def.com
    ServerAdmin [email protected]
    DocumentRoot /var/www/abc
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    SSLCertificateFile /etc/letsencrypt/live/abc.def.net-0001/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/abc.def.net-0001/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>

We have a very small virtual environment with only two Server 2012 VMs. We just purchased a license (local government entity) for Windows Server 2016 in order to add another VM to our stack. I'm having trouble activating the new VM. We are not using a KMS because that seems like a lot of extra work for such a small group. But when I attempt to activate the new 2016 server with the MAK key provided from microsoft.com/licensing, it says the system must connect to a local licensing service. Then it fails with 0xc004e028 error: "We can't activate Windows on this device right now. You can try activating again later or go to the store to buy genuine Windows."

What is the correct procedure to activate Windows Server 2016 using a MAK key and Microsoft's activation servers (not local), avoiding the need for local KMS infrastructure?

Thanks

Does anyone know the simplest way to migrate a Windows 10 Pro (x64) guest from a XenServer 6.5 host to Virtualbox? XenServer is proving to be very difficult to manage for this setup, which is to simply host a couple of Windows guests for remote access use. I think running these guests in Virtualbox on a linux host would make the administration a lot easier.

I'm thinking that it might work to use a hard drive backup tool to make a full system image within the existing guest OS, then boot a new Virtualbox instance from the backup tool's bootable recovery media, then restore the backup. As long as the recovery software supports restoration to different hardware, this should work... but is there an easier way? i.e. export the existing guest's hard drive image to a VMDK or similar file?

Thanks for any insight.

Is there a "simple" way to upgrade Centos 7.5.1804's version of httpd in order to support http/2? Currently running Apache/2.4.6 and PHP 7.0.30.

For this production server, compiling from source is not an option. Was hoping there's an EPEL or other repo that has the latest version and is a drop-in upgrade.

I found this, but it's from 2016. Hoping there's a better answer now.

Thanks for any pointers.

I'm trying to figure out how to provide a proxy server for Modbus/TCP traffic. This is non-http traffic (industrial protocol), and usually connects to port 502.

The purpose is to give remote devices a static IP address which they can connect to (i.e. a cheap cloud server) while supporting dynamic IP addresses at the destination (i.e. standard DSL/cable internet).

Can SQUID (or other linux-based proxy) be configured to

1. Listen on port 502 for incoming connections

2. Transparently pass the connection on to an IP address which is specified in the configuration file

3. Support dynamic destination IP addresses, possibly linked to a dynamic DNS update client or hostname?

Suggestions for accomplishing this are greatly appreciated.

I have a LAMP stack. I'm using the following .htaccess file to automatically map requests to .php files:

RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^([^\.]+)$ $1.php [NC,L]

So if I browse to http://example.com/asdf the "asdf.php" file will be loaded.

However, if I create a .css file with the same name (i.e. "asdf.css"), then the server returns the css file instead of the PHP file when browsing to the name without extension. Also seems to happen for .txt file extensions, and probably any other three-character extension (although does NOT happen for .js files).

I can't understand why this is happening. My understanding of the rewrite ruleset is this: 1) if the file being requested doesn't exist THEN 2) if the filename does NOT contain a period, redirect the request to [filename].php

How can this ever return a .txt or .css file, especially when the matching .php file exists? What am I missing here?

Thanks!

I'm trying to launch a PHP script in the background (Linux/Centos 6.8) by appending the & symbol to the command. However, 'jobs' lists the script with status [1]+ Stopped. Issuing a 'bg 1' to run the script in the background still results in a "[1]+ Stopped" output.

I can issue 'fg 1' and the script runs in the foreground with no problems.

What am I doing wrong?

I am piping both stdout and stderr to files using > output.txt 2> error.txt

The script issues some shell commands including wget.

Thanks for any info to clarify this.

Background: XenServer 6.5 with Windows 10 guest, Windows XP guest, and 2 Linux guests.

Has been running fine for 2+ months.

Yesterday, when I opened XenCenter and clicked the Windows 10 client's Console tab, the client apparently froze. (Or the graphics driver crashed, I can't tell.) LogMeIn and Splashtop both lose their connections.

The Linux and Windows XP guests don't exhibit this behavior.

I had to do a Force Reboot on this guest to get it back. Still can't click its Console without losing all remote connections (LogMeIn and Splashtop) and requiring a Force Reboot.

Any ideas how to troubleshoot and/or fix this? (I posted on the Citrix forum but Tobias hasn't had a chance to reply yet)

Thanks!

This is a question about whether to use Bridged or Routed OpenVPN setup, and how to set up the connection.

TLDR:

• One master site, multiple satelite sites. All sites are on the same subnet.
  • If using Bridged mode, how to prevent unwanted traffic on the VPN (bandwidth/data use are limited).
  • If using Routed mode, how to route individual IP addresses (not subnets) to specific VPN endpoints?

Background: the subject is a wastewater treatment plant with several (3+) remote pump stations. The main office runs our SCADA system and has multiple PLCs and workstations.

Each remote pump station has one or more PLCs/PanelView units, and currently all remote sites utilize 150MHz radio signals to send telemetry data back to the main location.

Due to poor signal quality and bandwidth limitations of the radios, we are hoping to switch all the sites to use 4G cellular data modems instead.

For security and simplicity, I think the best approach is to set up an OpenVPN-enabled router at each location (currently using Linksys E1200 running DD-WRT latest version) and configure them to connect to an OpenVPN server at the main office.

However, there is a problem: all the remote sites use the same subnet as the main site. This was set up by the vendor who installed the radios, apparently to "keep things simple" but it has been only headaches for us. We can't change the IP address mappings because we don't have the programming software for some of the devices, and also it would require reprogramming in each PLC. So we're stuck with all sites being on the same subnet. (192.168.100.x)

My question is: should I use Routing or Bridging mode for this setup?

If I use Bridging mode, I don't want the OpenVPN bridge to pass any superfluous traffic (broadcast, etc) because the cellular modems have limited monthly data transfer allowances.

If I use Routing mode, how can I force OpenVPN to only route the specific IP addresses that apply to remote sites?

For example: Main site: uses 192.168.100.1 - 30, also 40+

Remote site 1: 192.168.100.32-37 Remote site 2: 192.168.1.31 Remote site 3: 192.168.100.110-120, 140

So we can't route based on subnet - but must route individual IPs to the various locations.

I would appreciate any advice for this setup.

I tried Routing mode using specified routes with 255.255.255.255 subnet mask but was unable to get traffic to pass between one site and the main location. The OpenVPN connection was established successfully but could not ping between them.

I have an Asus motherboard with PIKE card (based on LSI chipset I believe) running Xenserver 6.5. Is there any way to see the RAID status within the virtual host without the need to reboot and enter the configuration utility?

All I need to know is "Good/Rebuilding/Degraded/Failed" status.

lspci shows the hardware as:

0e:00.0 SCSI storage controller: LSI Logic / Symbios Logic SAS1068E PCI-Express Fusion-MPT SAS (rev 08)

Thanks!

I have a Xenserver which the primary drive has failed to the point it won't boot. However, my RAID containing the SRs is fine. I can boot with gparted USB stick and mount the RAID LVM and see the .VHD files. However, I don't know which VHDs I actually need (only a couple VMs are important on this server).

Any way I can mount the VHD files (without copying them to USB and carrying to another computer, due to VERY slow transfer to USB)?

I tried installing virtualbox-fuse inside the gparted environment, but apt-get can't find the package. I also tried grabbing the .deb directly but it depends on virtualbox, which depends on a gazillion other packages.

Thx for any help.

I have an old server running Sendmail and Dovecot 0.99. There are about 50 email accounts on this server, associated with various domain names hosted on it. The email data is stored in MBOX format on the old server.

I need to migrate these email accounts to a destination server running Postfix and Dovecot 2.x. The destination server uses Maildir format.

Migration of emails themselves is easy using imapsync. HOWEVER, the POP UIDL values are not preserved. This causes any users with POP clients (MS Outlook, etc) to re-download all messages in the inbox as duplicates into their mailbox.

How can I preserve the UIDs?

I have tried dovecot dsync, but the documentation is poor, and I keep getting error messages that don't make sense.

NOTE: We cannot require users to switch from POP to IMAP, or change any settings in their client software. The migration must be transparent to users.

Thank you in advance for any advice!

I'm running postfix on a mail server which is used by a couple hundered users. One user is getting "Connection Interrupted" errors in Outlook when attempting to send. I have not had reports of this problem from anyone else.

Closing/reopening Outlook does not solve the problem. Restarting Postfix daemon on my end solves the problem. It is as if the connections are not being closed cleanly, thus triggering the smtpd_client_connection_count_limit which is set to 8. Possibly the user's virus scanner is grabbing the SMTP traffic and failing to terminate the session properly...

Is there any way I can see a list of current "open connections" to the postfix service, along with the source IP address and possibly the username used to authenticate? I want to see if this user's connection count increases over time.

I realise I can use netstat -pt | grep smptd to find open connections to the smtpd daemon and show the remote IP address. I'm looking for more details which may include username, as there are several users coming into our server from the same IP address as the problem user.

Appreciate any info.

Thanks

I am attempting to migrate several hundred email accounts from an old server running sendmail 8.13.6/dovecot 0.99.14 (mbox format) to a new server running postfix 2.6.6/dovecot 2.0.9 (maildir format).

I tried migrating a couple mailboxes with dsync and also tried with imapsync, but in both cases the message UIDLs are being changed, which will obviously cause pop desktop clients to re-download all messages in their pop inbox, which in turn will yield a lot of angry calls and emails from my users.

The strange part is that apparently in the old dovecot 0.99.14, a different UIDL format was used: example old format UIDLs: 1391619175.6 and 1391619175.7 for two consecutive messages. New format UIDLs assigned to these two messages upon import: 0000000152f30760 and 0000000252f30760 using the format %08Xu%08Xv defined in dovecot.conf

And I am not seeing an option in the 0.9 version's dovdcot.conf file to indicate what format this is, so I'm not sure how to configure the new installation to mimic this format.

Any insight into a good way of preserving the old UIDLs would be greatly appreciated.